Eavesdropping of two-way coherent-state quantum cryptography 
via Gaussian quantum cloning machines 
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We consider one of the quantum key distribution protocols recently introduced in Ref. [Pirandola 
et al., Nature Physics 4, 726 (2008)]. This protocol consists in a two-way quantum communication 
between Alice and Bob, where Alice encodes secret information via a random phase-space displace- 
ment of a coherent state. In particular, we study its security against a specific class of individual 
attacks which are based on combinations of Gaussian quantum cloning machines. 



INTRODUCTION 

Recently [H, 0] j we have shown how two-way quantum 
communication can profitably be exploited to enhance 
the security of continuous variable quantum key distri- 
bution d, 0, d, Q ■ In particular, we have investigated the 
security of two-way protocols in the presence of collective 
Gaussian attacks which are modelled by combinations of 
entangling doners Even though this situation is the 
most important one from the point view of the practical 
implementation, the effect of other kind of Gaussian at- 
tacks (i.e., not referable to entangling doners) must also 
be analyzed. In this paper, we study the security of the 
two-way coherent-state protocol of Ref. [3] against in- 
dividual attacks where an eavesdropper (Eve) combines 
two different Gaussian quantum cloning machines (also 
called Gaussian doners). In particular, we are able to 
show the robustness of the two-way protocol when the 
first doner is fixed to be symmetric in the output clones. 
This symmetry condition enables us to derive the results 
quite easily but clearly restricts our security analysis to 
a preliminary stage. For this reason, the optimal per- 
formance of Gaussian doners against two-way quantum 
cryptography is still unknown at the present stage. 



ADDITIVE GAUSSIAN CHANNELS AND 
GAUSSIAN CLONERS 

Consider a stochastic variable X with values x G 
distributed according to a Gaussian probability 
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with variance S^. This variable is taken as input of a 
classical channel that outputs another stochastic variable 
Y with values y G M. In particular, the classical channel 
is called additive Gaussian channel if, for every input 
X, the conditional output y\x is Gaussianly distributed 
around x with some variance cr^ Q. As a consequence. 



the output variable K is a Gaussian variable with zero 
mean and variance + c^. According to Shannon's 
theory the classical correlations between the input 
and output variables lead to a mutual information 
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I{X,Y) = -log(l+7) 



(2) 



where 7 = Y? ja^ is the signal to noise ratio (SNR). This 
formula gives the maximal number of bits per Gaussian 
value that can be sent through a Gaussian channel with 
a given SNR (on average and asymptotically). 

In quantum information theory, an example of addi- 
tive Gaussian channel is provided by the Gaussian quan- 
tum cloning machine (GQCM) Q . Consider a continuous 
variable (CV) system, like a bosonic mode, which is de- 
scribed by a pair of conjugate quadratures x and p, with 
[x,p\ — i, acting on a Hilbert space 7i. Then, consider a 
coherent state \(f) with amplitude (p = {x + ip)/-\/2- A 
1^2 GQCM is a completely-positive trace-preserving 
linear map 



(3) 



such that the single clone states, pi = tr2(pi2) and p2 — 
tri(/9i2), are given by a Gaussian phase-space modulation 
of the input state i.e.. 



where 
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Z)(/i) = cxp{fia^ — p,*a) 



(4) 



(5) 



(6) 



In Eq. ([5|), the quantities cr^ are the error variances in- 
duced by the cloning process on both the x and p quadra- 
tures of the k-th clone. Notice that here we consider a 
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GQCM which clones symmetrically in the quadratures 
(in general, one can have a Gaussian doner which is 
asymmetric both in the clones and the quadratures, with 
four different noise variances cr^p, cr| ,j and trip.) 

The previous variances do not depend on the input state 
{universal GQCM) and satisfy the relation 

ajaj > 1/4 , (7) 

imposed by the uncertainty principle. In particular, the 
previous GQCM is said to be optimal if crjcrl = 1/4- In 
terms of Shannon's theory, each of the two real variables, 
X and p, is subject to an additive Gaussian channel with 
noise equal to cr^ during the cloning process from the 
input state to the output fc-th clone. 

TWO-WAY COHERENT-STATE PROTOCOL 

The protocol is sketched in FiglT] and consists of two 
configurations, ON and OFF, that can be selected by 
Alice with probabilities 1 — c and c respectively. 



Bob Eve Alice 




FIG. 1: Two-way coherent-state protocol in both the ON and 
OFF configurations. 

Let Bob prepare a reference coherent state (/?|, with 
amplitude (3 randomly chosen in the complex plane (e.g., 
according to a Gaussian distribution with a large vari- 
ance). Such a state is sent to Alice on the forward use 
of the quantum channel. In the ON configuration, Alice 
encodes a signal on this reference state via a phase-space 
displacement D{a) whose amplitude a = {xa + ipA) / 
is chosen in the C-plane according to a random Gaussian 
distribution fl^2{a) with large variance S^. Notice that 

(i) The signal amplitude a symmetrically encodes two 

signal quadratures, xa and pA, i.e., two indepen- 
dent and real random variables distributed ac- 
cording to Gaussian distributions 0-^2 {x a) and 
Gs^iPA)- 

(ii) The output state 

b{am{P\DHa) = \a + (3){a + l3\ , (8) 



encodes the signal amplitude a, masked by the ref- 
erence amplitude /3 chosen by Bob. 

The state is finally sent back to Bob, who tries to guess 
the two Alice's numbers xa and va by a joint measure- 
ment of conjugate observablesllOj . This is accomplished 
by a heterodyne detection [llj of the state, which will 
give an outcome C « a -I- /3. After the subtraction of the 
known value f3, Bob achieves an estimate a' of Alice's 
complex amplitude a, i.e., « xa and ~ pA- 

In the case of a noiseless channel between Alice and 
Bob, the only noise in all the process is introduced by the 
heterodyne detection. This measurement can be seen as 
a further Gaussian additive channel at Bob's site, which 
gives a Gaussian noise equal to 1 for each quadrature. 
Thus, according to Shannon's formula, we have 

lAB^I{xA,XA) + I{PA,PA)^'^Og{l+'yAB) , (9) 

with JAB = 

Let us now consider a noisy channel adding Gaussian 
noise with variances (in the forward path) and a ^ (in 
the backward path) for each quadrature. Then, the total 
noise of the channel is tr^^ = tr^ -f cr ^ and the total noise 
which Bob tests, after detection, is equal to ct^ = + 
giving a SNR 7^5 = S^/u^. In the OFF configuration, 
Alice and Bob estimate the noise in the channel by per- 
forming two heterodyne detections. After receiving the 
reference state, Alice simply heterodynes it with outcome 
/?' and then reconstructs a coherent state ji?). This state 
is sent to Bob, who gets the outcome ^ d after detec- 
tion. In this way, Alice and Bob collect the pairs {/?, /?'} 
and {1?, from which they can estimate the two noises 
and a'^ of the channel via public communications. 
Notice that here we are using the ON configuration to 
encode the key and the OFF configuration to check the 
noise of the channel. This means that we are implicitly 
assuming that Eve's attack is disjoint between the two 
paths of the quantum communication (i.e.. Eve is using 
two distinct one-mode GQCMs). More generally, in or- 
der to exclude joint attacks between the two paths, the 
ON and OFF configurations must be used symmetrically 
for encoding and checking P. 

EAVESDROPPING VIA GAUSSIAN CLONERS 

In the previous two-way quantum communication, the 
choices of the reference /? and the signal a are two inde- 
pendent processes. As a consequence. Eve has to extract 
information on both the reference f3 and the total dis- 
placement a + (3 in order to access Alice's encoding a 
(this is true until the attack is disjoint). Let us consider 
two different attacks, one on the forward use of the chan- 
nel and the other one in the backward use, by using two 
optimal GQCMs which we call A'l and M', respectively 
(see Fig. [T]). 
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Since the reference /3 and the signal a are chosen with 
large variances, such machines must be universal, and 
since the information is symmetrically encoded in the two 
quadratures, we consider equal cloning noises in x and y. 
For these reasons. Eve's GQCMs are exactly of the kind 
specified by Eq. (g]) with (j\a\ = 1/4. After cloning, Eve 
must extract the information about a from her clones. 
She can directly heterodyne the clones. Alernatively, she 
can send the clones to a beam-splitter (BS), with suitable 
reflection and transmission coefficients r and i, and then 
heterodynes the output ports. 

In order to study the eavesdropping depicted in Fig. [U 
it is not sufficient to consider the reduced states pfc of 
the two single clones at the output of M, but we have to 
compute explicitly the whole bipartite state pn of modes 
1 and 2. In fact, mode 1 is sent to Alice (who displaces 
it) and then cloned by M' into the output modes 1' and 
2'. The second mode 2' then interferes with the previous 
mode 2 on the beam-splitter. For this reason, we have to 
keep all the correlations between the various modes till 
the interference process. One can prove that the bipartite 
state pi2 at the output of the optimal GQCM M is a 
Gaussian state with correlation matrix (CM) equal to 
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where / is the 2 x 2 identity matrix. The CM of Eq. ([TI 
has positive partial transpose for every cr^ > 0, and, 
therefore, pi2 is always a separable state [ll]. This means 
that Eve cannot exploit strategies based on the entangle- 
ment between her clones and the ones of Alice and Bob. 
In the particular case of symmetric cloning (cr^ = 1/2), 
we can write the useful decomposition 



pi2 = I (ffi Vti/2{p)'X 

l/3-f /i>i(/3 + ^| ® |/3-t-/^)2(/3 + Ml • 



(11) 



Then, let us consider the case where the first doner M 
is optimal and symmetric {a\ = (t| = 1/2), while the 
second doner M' is optimal but asymmetric, with ct^, = 
a;^ and (7|, = 1/40;^. In this case, at the output modes 
-I- and — of the BS, we have the bipartite state 

P+- = j f^i/2(M) x(m) (12) 

where 

x(m) = j rf^A 17i/4„2(A)x 

\e+ + \r)+{e++\r\ (g) \9^+Xt)^{9^+Xt\ , (13) 



and 



{p + l3){t + r) + ar, 



{p + l3){t-r) + at . (14) 



If we now take a balanced BS (i.e., t — r — 1/ \/2) we have 
0_ = a/\/2 and, therefore, the output port — does no 



longer contain the reference /3. Here, the action of the BS 
is very similar to the sum(mod2) performed over a binary 
key (fc) and the corresponding encrypted message (fc®m), 
operation that reveals the message in the classical case 
{k(B m(B k = m). On the other hand, the other port -I- 
still contains a mixing between a and /3 and, therefore, 
does not provide further information about the signal. 
Tracing out this port, we have 



P- 



d?\ 17i/4^2(A) \{a + \)/V2)^{{a + \)/V2\ 



(15) 

Heterodyning such a state, Eve can estimate the value of 
a up to a Gaussian noise with variance 
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for each quadrature. For Bob, instead, we have a total 
noise 
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ch I 
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equal to the sum of the heterodyne noise (1) and the total 
channel noise 



'^c\ = l/2- 



(18) 



According to Shannon, Bob {B) and Eve [E) will share 
with Alice {A) a mutual information equal to Iax = 
log(l -I- 7Ax) with = S^/cr^, for X = B,E. Since 



lAB 



> I 



AE 



lAB > lAE 



2^2 



(19) 



we can easily compute a security threshold for this kind 
of attack, which is equal to 



'ch 



= (3 + \/5)/4~ 1.3 



(20) 



Such a threshold must be compared with the security 
threshold (0.5) which characterizes one-way coherent- 
state protocols [5I, Q against individual GQCM attacks. 



CONCLUSION 

In this paper we have considered one of the two-way 
protocols introduced in [l[. Then, we have explicitly 
studied its security in the presence of particular kind 
of individual attacks which are based on combinations 
of one-mode Gaussian doners. Our analysis indicates 
that the superadditive behavior of the security threshold 
should also hold against this kind of Gaussian attacks. 
However, our analysis is far to be complete since we 
have considered only particular combinations of doners 
and we have also excluded the possibility of a two-mode 
doner (acting coherently on both the paths of the quan- 
tum communication). Furthermore, the analysis covers 
the case of direct reconciliation only. Despite these re- 
strictions, the present work represents the first step in 
the security analysis of two-way protocols against more 
exotic kind of Gaussian interactions. 
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